Rust's crates.io malicious typosquatting crate "rustdecimal" security advisory
blog.rust-lang.org
blog.rust-lang.org
They’d need to typosquat the namespace identifier and then could use the same crate (and could easily do it for all crates from a namespace) - as a defense against typosquatting, namespacing seems kind of useless. A better defense would be to calculate the levenshtein distance a new crate has to existing crates and notify a human to make a decision about it - but that would (a) be computationally expensive and (b) require a human in the loop, which does not work well with a volunteer team such as the crates.io team.
Your best defense is making a (partial) mirror of crates.io and only add crates after a review that satisfies your security requirements.
The standard library lacks a few things you find built-in in most other languages hence you have to use external crates. At the same time, the language is new so there are sometimes no "obvious" crates to select and you simply have to wing it.
And what was the url? People that do network monitoring could look for the outbound dns/http requests to determine if any host on their network had the malicious crate. A system might even still be infected and trying to download the payload.